Spot the scam: a free 10-question check.

Ten everyday situations. Pick the safest step, then see why. You score yourself in your browser: nothing is sent and nothing is saved.

Read the situations

These are the same kind of questions. Open each one to see the safest step.

At 4:40 pm on Friday you get an email from a regular supplier saying their bank account has changed and the invoice due Monday must go to the new one. What is the best first step?
1. Reply to the email and ask them to confirm the new account number in writing before Monday
2. Call the phone number printed in the email signature to confirm the change
3. Phone the supplier on the number in your own file and confirm before changing anything
4. Pay the new account now, so the Monday invoice is not paid late
Show the safest step
The safest step: Phone the supplier on the number in your own file and confirm before changing anything
Why: Replying to the email or calling a number in it may reach the scammer. Use contact details you already hold, as Scamwatch advises.
A finance officer gets an email, apparently from the managing director who is boarding a flight, asking for a confidential $38,000 payment to a new supplier today and not to tell anyone. What should they do?
1. Pay quickly, because a managing director's instruction always overrides the usual procedure
2. Don't pay yet; check with the director on a trusted channel and follow normal approval
3. Reply asking for the supplier's full details, then make the payment today
4. Pay half now and the other half once the director's flight has landed
Show the safest step
The safest step: Don't pay yet; check with the director on a trusted channel and follow normal approval
Why: Urgency, secrecy and a new payee are classic signs. A real executive will accept a short check.
Your real supplier phones to ask why a payment you made last week has not arrived. You paid the account shown in an email about changed bank details. What does this most likely mean?
1. The bank is just slow, so wait another few days and see whether the money turns up
2. The supplier has probably lost the invoice and will find it soon
3. Nothing unusual, because suppliers often ask where their money is
4. The money may have gone to a criminal's account, so call your bank straight away
Show the safest step
The safest step: The money may have gone to a criminal's account, so call your bank straight away
Why: This is how many payment-redirection scams are discovered. Time matters for recalling funds.
In Scamwatch's false billing story, an accounts clerk changed a supplier's bank details after one email and paid $17,000 to the wrong account. Which pair of habits would most likely have stopped it?
1. A faster internet connection and a larger email inbox for the accounts team
2. A callback to a number on file, and a second person approving the change
3. Paying suppliers only on Fridays, when the office is quieter
4. Asking the sender to resend the email in a different file format
Show the safest step
The safest step: A callback to a number on file, and a second person approving the change
Why: Both the callback and a second approver are advised by Scamwatch and the Australian Cyber Security Centre.
A new employee gets a chat message from "the managing director", on an account created this morning, asking them to buy five gift cards for a client and send the codes. What is the best response?
1. Don't buy anything; check with the real director or your manager and report the account
2. Buy the cards, because new staff should show they are willing to help and the director is clearly busy
3. Ask the sender for the client's name first and then buy the cards
4. Buy the cards but send only half of the codes until you are repaid
Show the safest step
The safest step: Don't buy anything; check with the real director or your manager and report the account
Why: INCIBE lists gift-card purchases presented as urgent company payments as a common CEO-fraud variant. Newcomers are targeted because they do not know who asks for what.
You receive an invoice from "billing@harbourIine-supplies.example". Your past invoices came from "billing@harbourline-supplies.example". What is the difference and what does it suggest?
1. Nothing, because both addresses are exactly the same as each other when read quickly
2. The new one is safer, because it uses a capital letter in the name
3. It shows the supplier has moved to a newer email system this year
4. A capital I replaces a lowercase l, so it is probably a look-alike address
Show the safest step
The safest step: A capital I replaces a lowercase l, so it is probably a look-alike address
Why: Look-alike domains swap, add or remove characters. Compare new addresses with past genuine invoices letter by letter.
An invoice arrives with the same purchase order number as usual, but different bank details and the line "new account effective immediately". What should you do?
1. Pay it, because the purchase order number is correct and everything else matches
2. Hold the payment, phone the supplier on the number in your file, and get a second approval
3. Reply to the sender and ask whether the bank change is genuine, then pay
4. Pay half to the usual account and half to the new one until it is sorted out
Show the safest step
The safest step: Hold the payment, phone the supplier on the number in your file, and get a second approval
Why: A correct purchase order number proves little because criminals copy real invoices.
A first-time customer asks for a quote on 60 laptops and wants delivery to a warehouse that is not on file, invoiced after delivery. The sender's domain was registered two weeks ago. What do you do before shipping?
1. Ship now to win the sale, since the order is large and the customer sounds keen to pay in 60 days
2. Call the phone number given in the email to confirm that the order is real
3. Find the real company's number on its genuine website, call it, and get manager approval
4. Ask for payment in gift cards before you agree to send anything out
Show the safest step
The safest step: Find the real company's number on its genuine website, call it, and get manager approval
Why: Do not rely on the email's own contact details. Check the order against the real company.
You receive a "FINAL NOTICE" invoice from a freight company you do not recall using, with a QR code to pay immediately. What is the best action?
1. Don't scan it; check your orders and delivery records, and report the email
2. Scan the code once, just to see where it goes and who is behind it, then decide
3. Pay a small amount first as a test, then pay the rest if it works
4. Reply to the sender and ask them to cancel the invoice for you
Show the safest step
The safest step: Don't scan it; check your orders and delivery records, and report the email
Why: Check your own records before acting on an unexpected invoice. Do not use the QR code.
A caller claims to be from a regular supplier and says the bank-change email was sent in error; the "correct" account is in a second email. He gives you a "direct line" to call him back. What should you do?
1. Call the direct line, since he offered it and it saves time
2. Accept the second email, because it corrects the mistake in the first and comes from the same sender
3. Transfer a small test amount to the new account and see what happens
4. Ignore the direct line, and call the supplier on the number already in your file
Show the safest step
The safest step: Ignore the direct line, and call the supplier on the number already in your file
Why: The caller supplies the number you are told to use to verify him, so it proves nothing.